0

I have a Nginx server that is hosting both the main domain foo.com and a subdomain bar.foo.com for a website. I only have a certificate for my main domain, so I only want HTTP requests for the subdomain. I have configured both server blocks, and all requests work well: http://foo.com will be redirected to https://foo.com, and http://bar.foo.com just stays on HTTP.

However, a problem rises when I tried to connect https://bar.foo.com, although I have not configured the subdomain server block to listen for 443 or ssl requests, the request is still handled, and after getting a warning from the browser that the certificate has a different host name than the one I am requesting, the page I get is from the main domain foo.com.

So, apparently, the server block that was supposed to only listen to HTTPS requests of my main domain, somehow is also listening to HTTPS requests of the subdomain, I don't want this to happen.

Here is my configuration for the main domain:

server {
  listen       80;
  server_name  foo.com www.foo.com;

  return 301 https://$server_name$request_uri;
}

server {
  listen       443 ssl;
  server_name  foo.com www.foo.com;

  ssl                  on;
  ssl_certificate      /etc/nginx/cert/foo.com.pem;
  ssl_certificate_key  /etc/nginx/cert/foo.com.key;
  ...

  location / {
    root   /var/www/foo.com/public_html;
    index  index.html index.htm;
  }
}

Here is my configuration for the subdomain:

server {
  listen       80;
  server_name  bar.foo.com www.bar.foo.com;

  location / {
    root   /var/www/bar.foo.com/public_html;
    index  index.html index.htm;
  }
}

And here is a snippet of the Nginx configuration file:

server {
  listen       80 default_server;
  listen       [::]:80 default_server;
  server_name  _;
  root         /usr/share/nginx/html;

  location / {
}

I have tried deleting foo.com after listen in the 443 server block of my main domain, but it doesn't help.

I would like Nginx either not listen to requests such as https://bar.foo.com or to simply return 404 or 444.

  • Configure a default server to return 444 for unmatched SSL certificate names. This answer contains more details: serverfault.com/q/373929/131019 This relies on your visitors implementing SNI, which you can mostly rely on these days. – Cosmic Ossifrage Mar 25 '18 at 14:00
  • @CosmicOssifrage Sorry, I am new to Nginx, may you tell me exactly how to configure such server? I have looked at the answer you provided but are still confused. Thanks a lot! – George Yu Mar 25 '18 at 15:09
  • Does the file really end with .conf. Just curious, because it seems to be ignored. – ansi_lumen Mar 25 '18 at 15:30
1

Since you have only one server block configured for port 443, it is the default virtual server used by nginx to service all requests to port 443.

To add a default server for port 443 (TLS), you can add the following virtual host:

server {
    listen 443 default_server;
    server_name _;
    return 444;
}
1

I have figured out the solution. Just like @Tero and @Cosmic correctly pointed out, my only 443 server block for the main domain is being set to the default server block for all 443 requests.

I commented the server block in the Nginx configuration file /etc/nginx/nginx.conf and added the following two server blocks:

server {
  listen      80 default_server;
  server_name  _;
  return 444;
}

server {
  listen       443 ssl default_server;
  server_name  _;
  ssl_certificate      /etc/nginx/cert/foo.bar.pem;
  ssl_certificate_key  /etc/nginx/cert/foo.bar.key;
  return 444;
}

The first one will be set to the default server block for any HTTP requests, dropping any unmatched requests, and similarly the second one will drop any unmatched 443 or HTTPS requests.

The solution that @Tero provided won't work, because Nginx expects a certificate for any SSL server blocks, so you will need to provide it with a certificate.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.